Malicious
ZIP Archive
MD5: 40b4df2d93673222d07e5380c05bcc57
Size: 2.88 MB
application/zip
Ctrl + scroll to zoom · drag to pan
Get an AI-generated breakdown of this malware's behaviour, IOCs and recommendations.
AI analysis is available with Essential.
Unlock with EssentialFile
Type
ZIP archive
Size
2.88 MB · 2,877,082 B
First seen
2026-08-19 19:31 · 2 months ago
Last seen
2026-08-19 19:31 · 2 months ago
Last analysis
2026-08-19 19:31 · 2 months ago
Hashes
MD5
40b4df2d93673222d07e5380c05bcc57
Sha1
d2ddb01d5bdb9d2a15fead11392b5c63a23a0dd4
Sha256
43f1cf980546901863c625ab3fa04961b720167421f78fe6558b204cf081f826
Sha384
921e0d7febc9bf3415ee42662ce32e572045c571a02651162c42814e3a0c46a89782402eb9bfbf3307f76483d5832d9d
Sha512
5aaef0f6123d4ddc0518077e2900040e145b3438f4ef7c858abf0aa498e27778a0ed60a57e0f7a92318516f588e47f5965712033b64581bf0c9aaf815b248bb8
SSDeep
49152:MjSjLhqTU4qTULygqhUuAO6KPlGWR0ko8lNt1vGcrRwLPvAFVF1F1Fe/JJlLthiV:Amz9GuFlGy0ko8/t1vGcrRwLPoFVF1FX
TLSH
65D533D0A07BA719CCB78171D483810C8BC79A17D776486D3F955C84E6290ABAB73FB2
7 malicious · 52 files
ZIP40b4df2d93673222d07e5380c05bcc57T1027 · T1059.001
XMLRuby Blue.xml
XMLSolarized.xml
XMLSolarized-light.xml
XMLstylers.model.xml
XMLSystem Diagnostics.xml
XMLtex.xml
XMLTwilight.xml
XMLVibrant Ink.xml
XMLvim Dark Blue.xml
XMLZenburn.xml
XML2024-06-03 18.37.28.254 Graphics3D.Assessment (Initial).WinSAT.xml
XML2024-06-03 18.39.08.511 Formal.Assessment (Initial).WinSAT.xml
XMLAllSystemSettings_{253E530E-387D-4BC2-959D-E6F86122E5F2}.xml
XMLAllSystemSettings_{D6E2A6C6-627C-44F2-8A5C-4959AC0C2B2D}.xml
XMLAllSystemSettings_{FDB289F3-FCFC-4702-8015-18926E996EC1}.xml
XMLAppxBlockMap.xml
XMLAppxManifest.xml
XMLbatch.xml
XMLbehavior.xml
XMLBespin.xml
XMLBlack board.xml
XMLbzbui_interface.xml
XMLChoco.xml
XMLDansLeRuSH-Dark.xml
XMLDarkModeDefault.xml
XMLDeep Black.xml
XMLGlobalInstallOrder.xml
XMLfms_metadata.xml
XMLHello Kitty.xml
XMLHotFudgeSundae.xml
XMLIGCC.xr.xml
XMLIMJPCLST.XML
XMLkhaki.xml
XMLmanifest.xml
VBSlangs.model.xmlT1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[Deobfuscated PS]T1027 · T1059.001
PS1[PowerShell Command]T1059.001
PS1[Deobfuscated PS]T1059.001
PS1[PowerShell Command]T1059.001
XMLMono Industrial.xml
XMLMonokai.xml
XMLMossyLawn.xml
XMLNavajo.xml
XMLNetTrace.PLA.Diagnostics.xml
XMLObsidian.xml
XMLPFL_Package_for_RollupFix~~amd64~~22621.3593.1.13.xml
XMLPFL_Package_for_RollupFix~~amd64~~22621.3672.1.18.xml
XMLPFL_Package_for_RollupFix~~amd64~~22621.4037.1.18.xml
XMLphp.xml
XMLPlastic Code Wrap.xml
STICH
beta
Structural Threat Infection Chain Hash
A content-independent fingerprint of the infection method: successive formats, internal objects and MITRE techniques from the initial file to each final payload.
Structural branches: 2
STICH kept: 1secondary ignored: 1
bin
1Decorative / non-determinant leaves (styles, themes, media, fonts, icons, plain text…) are summarized here instead of producing STICH Paths.
STICH Path = the fingerprint (canonical chain with techniques)
STICH Shape = structure only
Only determinant branches produce STICH Paths.
Path
arc:zip>scr:vbs~T1027~T1059.001>scr:ps1~T1027~T1059.001
Shape
arc:zip>scr:vbs>scr:ps1
malicious
3 nodes